sfc / DISM - Repair System Files

Maintained on

When Windows becomes unstable, or standard features such as Settings or the Start menu stop working properly, System File Checker (sfc) is one of the first things to try. It scans the protected Windows system files and replaces any that are corrupted or have been modified with the correct version.

If sfc cannot fix the problem, combine it with the DISM command, which repairs the component store that sfc uses as its source. This article explains both commands and the order in which to run them.

Preparation: run as administrator

sfc and DISM work only in a Command Prompt that is running as administrator. If you run sfc without administrator rights, it shows an error saying that you must be an administrator running a console session, and the scan does not start.

To learn how to start Command Prompt as administrator, see

.

Basic syntax of sfc

sfc [/scannow] [/verifyonly] [/scanfile=<file>] [/verifyfile=<file>]
    [/offbootdir=<drive> /offwindir=<Windows_folder>] [/offlogfile=<log_file>]
OptionDescription
/scannowScans all protected files and repairs any problems
/verifyonlyScans all protected files but does not repair anything
/scanfile=<file>Scans one file and repairs it if there is a problem (specify the full path)
/verifyfile=<file>Scans one file but does not repair it (specify the full path)
/offbootdir /offwindirTargets a Windows installation that is not running (for example, from a recovery environment; both options are required)
/offlogfile=<log_file>Specifies where to write the log for offline repairs

Scan and repair the whole system

sfc /scannow

While it runs, progress is shown as “Verification xx% complete.” Depending on your environment, it can take from several minutes to an hour or more, so do not close the window or shut down the PC in the middle of a scan.

Do not interrupt it even if progress seems stuck

The percentage may seem to stay at one value for a long time, but the process is still running. Unless it has clearly stopped making progress for a very long time, avoid forcing it to quit.

How to read the result messages

When it finishes, one of the following messages is displayed.

Message (summary)Meaning and next step
Windows Resource Protection did not find any integrity violations.There are no problems with the system files. Look for another cause.
Windows Resource Protection found corrupt files and successfully repaired them.The repair is complete. Restart the PC and check whether the problem is gone.
Windows Resource Protection found corrupt files but was unable to fix some of them.Move on to “Repair the source with DISM” below.
Windows Resource Protection could not perform the requested operation.The repair could not run. Try again in Safe Mode. If it still fails, check whether the PendingDeletes and PendingRenames folders exist in C:\Windows\WinSxS\Temp. When running from a recovery environment, specify /offbootdir and /offwindir.
チェック

After a repair, run sfc /scannow once more to confirm that it reports no integrity violations.

Scan only, without repairing

If you only want to know the state of the system without changing it, use /verifyonly.

sfc /verifyonly

Scan and repair a specific file

If you know which file is corrupted, you can specify it by its full path.

Scan
sfc /scanfile=C:\Windows\System32\kernel32.dll
Scan
sfc /verifyfile=C:\Windows\System32\kernel32.dll

Check the details in the log

The details of sfc are recorded in C:\Windows\Logs\CBS\CBS.log. This file is very large, so it is easier to read if you extract only the sfc lines (those tagged with [SR]).

Save
findstr /c:"[SR]" "%windir%\Logs\CBS\CBS.log" > "%userprofile%\Desktop\sfcdetails.txt"

> is redirection, which writes the output to a file. For details, see

; for findstr, see .

Filter the log by [SR]

Other operations are recorded in the same log, so without filtering by [SR] it is hard to find the lines you want.

When sfc cannot fix it: repair the source with DISM

sfc repairs files using the copies stored in the component store (C:\Windows\WinSxS). If the component store itself is corrupted, sfc cannot repair anything. In that case, use DISM (Deployment Image Servicing and Management) to repair the component store.

DISM /Online /Cleanup-Image /RestoreHealth
CommandWhat it does
DISM /Online /Cleanup-Image /CheckHealthQuickly checks whether corruption has been recorded (no repair)
DISM /Online /Cleanup-Image /ScanHealthScans the entire component store (no repair)
DISM /Online /Cleanup-Image /RestoreHealthScans and repairs any corruption it finds

By default, /RestoreHealth downloads repair files from Windows Update, so an internet connection is required. It can take a long time, and the percentage may seem to stall partway through.

Order of execution

Microsoft’s guidance is to repair the source with DISM first and then run sfc. Another common approach is to try sfc first, move on to DISM only if that fails, and then run sfc once more. Either way, finish by confirming with sfc /scannow that the problem is resolved.

The steps when running DISM first are:

  1. Run DISM /Online /Cleanup-Image /RestoreHealth
  2. When it finishes, run sfc /scannow
  3. Restart and check whether the symptoms have improved
Run
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
In environments without a network connection

If the PC cannot reach Windows Update, you can use the /Source option to specify a healthy Windows image as the repair source. For example, specify /Source:WIM:X:\sources\install.wim:1, and add /LimitAccess if you do not want it to contact Windows Update. The image must match the installed Windows in version, edition, and language.

Run it from a batch file

Putting the steps into a batch file that runs with administrator rights saves you from typing them every time.

repair-system.cmd
@echo off
net session >nul 2>&1
if errorlevel 1 (
    echo Please run this as administrator.
    pause
    exit /b 1
)

echo === Scanning and repairing the source with DISM ===
DISM /Online /Cleanup-Image /RestoreHealth

echo.
echo === Scanning and repairing system files with sfc ===
sfc /scannow

echo.
echo Done. Check the results and restart if necessary.
pause

net session fails without administrator rights, so it is often used as a simple permission check. However, in an environment where the Server service is stopped, it can fail even for an administrator. To relaunch a script automatically with administrator rights, see

.

DISM records detailed logs in C:\Windows\Logs\DISM\dism.log. If DISM fails, check this file as well.

Summary

What you want to doCommand
Scan and repair system filessfc /scannow
Scan only, without repairingsfc /verifyonly
Scan and repair a specific filesfc /scanfile=full_path
Extract the sfc log detailsfindstr /c:"[SR]" "%windir%\Logs\CBS\CBS.log"
Repair the source (component store)DISM /Online /Cleanup-Image /RestoreHealth

Practice questions

Practice Problem

sfc /scannow reports that it “was unable to fix some of them.” What is the appropriate first thing to try?

Choose one answer.

  1. Run DISM /Online /Cleanup-Image /RestoreHealth as administrator, then run sfc /scannow again
  2. Run sfc /verifyonly repeatedly and wait for it to repair itself
  3. Manually delete the C:\Windows\WinSxS folder
#Command Prompt #Command Line #Commands #sfc #DISM #Administrator Rights #Troubleshooting